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USER CONNECTS TO THE FIRST SERVER 

USING A FIRST SECURE CONNECTION 
AND SENDS AN ENROLLMENT REQUEST 
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THE FIRST SERVER ENCRYPTS THE 
ENROLLMENT REQUEST USING THE 
FIRST SET OF AUTHENTICATION KEYS 
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THE FIRST SERVER TRANSMITS THE 
ENCRYPTED ENROLLMENT REQUEST TO 
A HOST APPLICATION 
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THE HOST APPLICATION DECRYPTS THE 
ENROLLMENT REQUEST AND ENCRYPTS 

AND RETURNS AN ENROLLMENT 
APPLET, PUBLIC KEY, SERIAL NUMBER 
AND ACCOUNT NUMBER TO THE FIRST 
SERVER. 



THE FIRST SERVER SENDS THE 
ENROLLMENT APPLET TO THE USER 
OVER THE FIRST SECURE CONNECTION 
AFTER DECRYPTION 
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THE USER ENTERS INFORMATION INTO 

THE ENROLLMENT APPLET, WHICH 
TRIGGERS THE APPLET TO CREATE A 
SECOND SECURE CONNECTION WITH 
THE SECOND SERVER 
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THE USER SELECTS AND ENTERS A PIN/ 
PASSWORD, WHICH THE ENROLLMENT 
APPLET ENCRYPTS WITH THE PUBLIC 
KEY SENT TO THE FIRST SERVER 



THE ENROLLMENT APPLET LINKS THE 
ENCRYPTED PIN/PASSWORD WITH THE 
ACCOUNT AND SERIAL NUMBER FROM 

THE FIRST SERVER AND SENDS IT TO 
THE SECOND SERVER 
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THE SECOND SERVER ENCRYPTS THE 
LINKED DATA USING THE SECOND SET 
OF AUTHENTICATION KEYS AND SENDS 
IT TO THE HOST APPLICATION 
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THE HOST APPLICATION DECRYPTS THE 
LINKED DATA AND VERIFIES THE 
ACCOUNT NUMBER AND SERIAL 
NUMBER 
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